The existing backdoor attack has been focusing on classification models. Despite this, the applicability of backdoor attacks against GANs is underexplored, especially in the field of medicine. This is due to the fact that backdoor attacks against GANs are more complex, since the input for GANs is a noise vector, while the output is a generated-new-mage. Backdoor in FL for classification models was initially introduced by  [1]}, where a constrain-and-scale technique is applied to amplify the malicious gradient of clients. In the study, the local clients are flexible to employ local training procedures. However, this scenario is unlikely to happen in the medical circumstances, given the organizer of the FL can enforce the proper training procedure on reliable hardware to prevent malicious clients from taking adversarial actions [2]}. In contrast to the previous backdoor federated classification study, we assume that there is a reliable FL pipeline that each client follows the provided training rules to calculate and update the correct parameters without modifying them, thereby performing the given training process in accordance with the instructions given by the trusted server (the organizer of the FL in reality). Then we investigate how backdoor attack can affect GAN for data synthesis in this FL setting.
